tickmarkr 2.6.0 → 2.6.2

package/dist/drivers/orca.js

@@ -5,7 +5,7 @@ import { shq } from "../adapters/types.js";
 import { createWorktree, FORK_CAP_ENV, resolvedForkCap, sh } from "../run/git.js";
 import { Journal, parseRunId } from "../run/journal.js";
 import { stateDirName } from "../graph/graph.js";
-import { readWatchBoard, requestWatchBoardStop, stopWatchBoard, WATCH_OWNER_ENV } from "../run/supervision.js";
+import { readWatchBoard, requestWatchBoardStop, stopWatchBoard, supervisionPresencePath, WATCH_OWNER_ENV } from "../run/supervision.js";
 import { MAX_BUF } from "./subprocess.js";
 import { formatOwnedName, panesToClose, parseOwnedName } from "./types.js";
 // Orca (onorca.dev) as a third execution surface beside herdr and subprocess. tickmarkr keeps
@@ -246,7 +246,12 @@ export function provesCheckout(text, checkout) {
  * subshell inside it all start in the checkout and its exit status is the payload's (FX-N02).
  */
 export function checkoutPrefix(checkout) {
-    return `cd ${shq(checkout)} && printf '%s\\n' ${shq(checkoutProofLine(checkout))} && sh -c `;
+    // OBS-1168: printf BUILDS the marker from two arguments, so the typed command never carries
+    // `TICKMARKR_CHECKOUT ` verbatim. The shell's echo of the typed line is repainted and truncated in
+    // the scrollback, which used to leave an INCOMPLETE frame beside the complete printed one and made
+    // provesCheckout refuse a correct launch. The printed bytes are exactly checkoutProofLine(checkout).
+    const head = CHECKOUT_MARK.slice(0, CHECKOUT_MARK.indexOf("_"));
+    return `cd ${shq(checkout)} && printf '%s%s\\n' ${head} ${shq(checkoutProofLine(checkout).slice(head.length))} && sh -c `;
 }
 /** The command a terminal on the tracked worktree runs so that it executes INSIDE the checkout. */
 export function inCheckout(checkout, cmd) {
@@ -449,6 +454,26 @@ function lockEntryGeneration(entry) {
     const legacy = /^pid(?:\.(\d+))?$/.exec(entry);
     return owner ? Number(owner[1]) : legacy ? Number(legacy[1] ?? 0) : undefined;
 }
+/** The placing claim window: how long a narrator waits for its observer to claim the reservation. */
+const CLAIM_WINDOW_MS = 5000;
+/** Reservation tokens THIS process held after an indeterminate split receipt (OBS-1172). Any other
+ *  reserved or claimed record under a live placer is a placement in flight (or a crash still being
+ *  judged) and is refused untouched; a held one is reconciled again on every call, never split over. */
+const held = new Set();
+/** A claimed board's observer is live when its pid answers AND the arm it claimed with is present. */
+function observerLive(r) {
+    return typeof r.pid === "number" && pidLive(r.pid) && typeof r.armId === "string"
+        && existsSync(supervisionPresencePath(r.repo, "watch", r.armId));
+}
+/** Tombstone THIS reservation while it is still the untouched reservation; a record anyone else moved
+ *  is left to them. Answers the tombstone, or undefined when the record was not this reservation. */
+async function tombstoneReservation(path, cwd, runId, token, time, extra = {}) {
+    const now = readBoard(path, cwd, runId);
+    if (now?.record.token !== token || boardState(now.record) !== "reserved")
+        return undefined;
+    const record = { ...now.record, ...extra, retired: true };
+    return { raw: await casBoard("split", path, now.raw, record, time), record };
+}
 function pidLive(pid) {
     try {
         process.kill(pid, 0);
@@ -696,6 +721,26 @@ export class OrcaDriver {
         }
         return { id, name: title, cwd: worktree, group: opts?.group };
     }
+    /**
+     * OBS-1109: bind THIS instance to a terminal an earlier daemon created for an OWNED slot, so a
+     * resumed daemon can read the interrupted attempt's pane. Binding needs ownership evidence, never
+     * a title or handle alone: exactly one tab on the tracked worktree carries the FULL journaled owned
+     * title, it resolves to exactly one terminal, and that terminal's scrollback proves the exact task
+     * checkout `slot.cwd` (the frame only tickmarkr's own create command prints). Zero, ambiguous or
+     * foreign candidates leave the slot unbound: the throw is the caller's decline. The journaled
+     * nonce is then checked by the caller against the trailer this binding reads.
+     */
+    async adopt(slot) {
+        if (!parseOwnedName(slot.name))
+            throw new OrcaError("list", `slot ${slot.name} carries no owned title — nothing to adopt`, "");
+        const cwd = canonicalWorktreePath(slot.cwd);
+        const st = { title: slot.name, cwd, buf: "", recoveries: 0, recovering: false };
+        st.tracked = await this.trackedWorktree(cwd);
+        await this.recover("adopt", st, undefined, "", { proveCheckout: true });
+        const id = `orca-${++this.n}`;
+        this.slots.set(id, st);
+        return { id, name: slot.name, cwd, ...(slot.group === undefined ? {} : { group: slot.group }) };
+    }
     /** Where to invoke the CLI for this slot's calls (see OrcaSlotState.dir). */
     cliCwd(st) {
         return st.dir ?? st.cwd;
@@ -974,7 +1019,7 @@ export class OrcaDriver {
             return { proven: false, reason: error instanceof Error ? error.message : String(error) };
         }
     }
-    async recover(family, st, newRuntimeId, raw) {
+    async recover(family, st, newRuntimeId, raw, opts) {
         if (st.recovering)
             throw this.latched(family, st, "handle recovery re-entered", raw);
         st.recovering = true;
@@ -1029,17 +1074,19 @@ export class OrcaDriver {
                 throw this.latched(family, st, `the owned tab resolves to ${panes.length} terminals in ${home}`, env.raw);
             }
             const handle = panes[0];
-            if (handle === old) {
-                // Handles are runtime-scoped: the same VALUE under a different runtime proves nothing about
-                // which terminal it addresses, so it is never adopted.
-                throw this.latched(family, st, `replacement handle ${handle} is the old handle value reused by runtime ${newRuntimeId ?? env.runtimeId ?? "unknown"}`, env.raw);
-            }
-            if (st.tracked !== undefined && st.tracked !== st.cwd) {
+            // Handles are runtime-scoped: the same VALUE under a different runtime proves nothing about
+            // which terminal it addresses. OBS-1108: it is therefore reconciled exactly like any other
+            // replacement plus the checkout proof — never on the handle text (a 2.5.8 latch refused a live,
+            // finished worker for hours) and never adopted without that ownership evidence.
+            const reused = handle === old;
+            if (reused || opts?.proveCheckout || (st.tracked !== undefined && st.tracked !== st.cwd)) {
                 // FX-N01: a nested checkout shares its worktreePath with every sibling task's terminal, so
                 // the candidate must prove the checkout itself (read-only) before it is addressed as ours.
                 const proof = await this.checkoutProven(handle, st.cwd, this.cliCwd(st), env.runtimeId);
                 if (!proof.proven) {
-                    throw this.latched(family, st, `candidate ${handle} does not prove checkout ${st.cwd} (${proof.reason}); the sole same-titled tab on ${home} is not adopted`, env.raw);
+                    throw this.latched(family, st, reused
+                        ? `replacement handle ${handle} is the old handle value reused by runtime ${newRuntimeId ?? env.runtimeId ?? "unknown"} and does not prove checkout ${st.cwd} (${proof.reason}); a reused handle value is not adopted on its text`
+                        : `candidate ${handle} does not prove checkout ${st.cwd} (${proof.reason}); the sole same-titled tab on ${home} is not adopted`, env.raw);
                 }
             }
             st.handle = handle;
@@ -1430,13 +1477,29 @@ export class OrcaDriver {
                 }
             }
             else if (current) {
-                const state = boardState(current.record);
+                let state = boardState(current.record);
+                const { placer, token: heldToken } = current.record;
+                if ((state === "reserved" || state === "claimed") && placer === process.pid && held.has(heldToken)) {
+                    // OBS-1172: THIS process held the placement after an indeterminate split receipt. Reconciled
+                    // again, never split over: adopted once proven, still held while unknown, and tombstoned
+                    // only once proven to have started nothing.
+                    const settled = await this.settleIndeterminate(cwd, path, runId, heldToken, launchingHandle, 0);
+                    if (settled.kind === "held") {
+                        throw new OrcaError("split", `Orca narrator placement remains unresolved for ${name} (${state}, held after an indeterminate split receipt): ${settled.why}; no second board is split over it; ${kept}`, "");
+                    }
+                    held.delete(heldToken);
+                    if (settled.kind === "adopted")
+                        return settled.slot;
+                    current = await tombstoneReservation(path, cwd, runId, heldToken, this.time);
+                    if (!current)
+                        throw new OrcaError("split", `Orca narrator placement remains unresolved for ${name}: the held reservation changed underneath; ${kept}`, "");
+                    state = boardState(current.record);
+                }
                 if (state === "reserved" || state === "claimed") {
                     // A reservation or claim with no bound pane is the placing narrator's normal intermediate
                     // state while that narrator lives (awaiting its receipt, listing, claim or bind): refused
                     // untouched, its observer never asked to stop. Only a DEAD placer (or one unrecorded) makes
                     // it a crash to recover.
-                    const { placer } = current.record;
                     if (typeof placer !== "number" || pidLive(placer)) {
                         throw new OrcaError("split", `Orca narrator placement remains unresolved for ${name} (${state}, no bound pane) while placing narrator ${placer ?? "unrecorded"} lives; ${kept}`, "");
                     }
@@ -1445,14 +1508,11 @@ export class OrcaDriver {
                     // The placing driver crashed between the observer's claim and its bind. The record is
                     // replaced only once that observer is proven gone: dead outright, or live and stopped with
                     // its acknowledgement awaited on injected time — unacknowledged, it is refused untouched.
-                    const pid = current.record.pid;
-                    if (pidLive(pid)) {
-                        try {
-                            await stopWatchBoard(current.record, this.time);
-                        }
-                        catch (error) {
-                            throw new OrcaError("split", `Orca narrator placement refused for ${name}: claimed board's live observer unacknowledged; ${kept}; ${errorText(error)}`, "");
-                        }
+                    try {
+                        await this.stopObserver(current.record);
+                    }
+                    catch (error) {
+                        throw new OrcaError("split", `Orca narrator placement refused for ${name}: claimed board's live observer unacknowledged; ${kept}; ${errorText(error)}`, "");
                     }
                     const retired = { ...current.record, retired: true };
                     current = { raw: await casBoard("split", path, current.raw, retired, this.time), record: retired };
@@ -1466,10 +1526,13 @@ export class OrcaDriver {
                 if (state === "bound") {
                     // The bound record is the durable truth of placement: the child handle PLUS the split
                     // envelope's runtime identity. A handle listed by a later runtime is a different pane.
-                    if (listedOnRuntime(await this.listAll(cwd), current.record.pane, current.record.runtimeId)) {
+                    // OBS-1131: it is adopted only while its observer lives — a resumed daemon retires the
+                    // board of a dead observer here (tombstone, stop request, handle-bound close) instead of
+                    // answering it and later spending a reopen to discover the death.
+                    if (observerLive(current.record) && listedOnRuntime(await this.listAll(cwd), current.record.pane, current.record.runtimeId)) {
                         return watchSlot(cwd, name, current.record.pane);
                     }
-                    // Lost: this runtime no longer has that pane. Tombstone before anything else.
+                    // Lost or dead: tombstone before anything else.
                     const retired = { ...current.record, retired: true };
                     current = { raw: await casBoard("split", path, current.raw, retired, this.time), record: retired };
                 }
@@ -1477,12 +1540,7 @@ export class OrcaDriver {
                 // observer must stop and ack on injected time before the handle-bound close; timeout keeps
                 // the tombstone and does not replace it.
                 try {
-                    if (typeof current.record.pid === "number" && pidLive(current.record.pid)) {
-                        await stopWatchBoard(current.record, this.time);
-                    }
-                    else {
-                        requestWatchBoardStop(current.record);
-                    }
+                    await this.stopObserver(current.record);
                 }
                 catch (error) {
                     throw new OrcaError("split", `Orca narrator placement refused for ${name}: retired board observer unacknowledged; ${kept}; ${errorText(error)}`, "");
@@ -1498,37 +1556,43 @@ export class OrcaDriver {
             // judged replaceable above.
             const token = randomUUID();
             await casBoard("split", path, current?.raw, { repo: realpathSync(cwd), runId, driver: this.id, workspace: ORCA_SPACE, pane: "", name, token, placer: process.pid }, this.time);
-            // A reservation that can never be bound — no usable receipt, or no claim — is tombstoned so the
-            // next narrator call splits afresh instead of refusing forever. Only THIS reservation, and only
-            // while it is still the untouched reservation; a record anyone else moved is left to them.
-            const tombstone = async (extra = {}) => {
-                try {
-                    const now = readBoard(path, cwd, runId);
-                    if (now?.record.token === token && boardState(now.record) === "reserved") {
-                        await casBoard("split", path, now.raw, { ...now.record, ...extra, retired: true }, this.time);
-                    }
+            // OBS-1172: a split whose receipt never arrived intact — a transport failure or timeout, an
+            // unparseable or handle-less body, a child the listing does not place in the launching tab —
+            // may still have started the board. It is reconciled before any failure: a uniquely proven
+            // live pane is adopted and bound; a split proven to have started nothing is tombstoned so the
+            // next call splits afresh; anything else is HELD — the reservation stays, and no later call
+            // splits a second board over it.
+            const indeterminate = async (reason, raw) => {
+                const settled = await this.settleIndeterminate(cwd, path, runId, token, launchingHandle, CLAIM_WINDOW_MS);
+                if (settled.kind === "adopted")
+                    return settled.slot;
+                if (settled.kind === "absent") {
+                    await tombstoneReservation(path, cwd, runId, token, this.time).catch(() => undefined);
+                    throw new OrcaError("split", `Orca narrator placement failed for ${name}: ${reason}; ${kept}`, raw);
                 }
-                catch { /* the record is kept as it stands; the next narrator judges it */ }
+                held.add(token);
+                throw new OrcaError("split", `Orca narrator placement unresolved for ${name}: ${reason}; ${settled.why} — the placement is held and no second board is split over it; ${kept}`, raw);
             };
             // Exactly one terminal split of the launching handle, horizontal, carrying token and command.
-            // An unknown receipt (transport failure, refusal, unparseable output) after the verb was issued
-            // is as indeterminate as a handle-less one: the pane may exist, so the reservation stays.
-            const env = await this.call("split", [
-                "terminal", "split",
-                "--terminal", launchingHandle,
-                "--direction", "horizontal",
-                "--command", `${WATCH_OWNER_ENV}=${shq(token)} ${command}`,
-            ], cwd).catch(async (error) => {
-                await tombstone();
-                throw new OrcaError("split", `Orca narrator placement failed for ${name}: split receipt is unknown (${error instanceof OrcaError ? error.reason : errorText(error)}); ${kept}`, error instanceof OrcaError ? error.raw : "");
-            });
+            let env;
+            try {
+                env = await this.call("split", [
+                    "terminal", "split",
+                    "--terminal", launchingHandle,
+                    "--direction", "horizontal",
+                    "--command", `${WATCH_OWNER_ENV}=${shq(token)} ${command}`,
+                ], cwd);
+            }
+            catch (error) {
+                return await indeterminate(`split receipt is unknown (${error instanceof OrcaError ? error.reason : errorText(error)})`, error instanceof OrcaError ? error.raw : "");
+            }
+            const malformed = "split receipt is unknown, malformed or handle-less";
             let child;
             try {
                 child = splitReceipt(env);
             }
             catch {
-                await tombstone();
-                throw new OrcaError("split", `Orca narrator placement failed for ${name}: split receipt is unknown, malformed or handle-less; ${kept}`, env.raw);
+                return await indeterminate(malformed, env.raw);
             }
             // Parent tabId must name the launching terminal's tab, and the child must actually appear
             // there. A handle-only object, a tabId for some other tab, or a handle the list does not
@@ -1538,21 +1602,19 @@ export class OrcaDriver {
                 listing = await this.listAll(cwd);
             }
             catch (error) {
-                await tombstone();
-                throw new OrcaError("split", `Orca narrator placement failed for ${name}: split receipt is unknown, malformed or handle-less; ${kept}`, error instanceof OrcaError ? error.raw : env.raw);
+                return await indeterminate(malformed, error instanceof OrcaError ? error.raw : env.raw);
             }
             const launchingTabId = terminalTabId(listing, launchingHandle);
             if (!launchingTabId
                 || child.tabId !== launchingTabId
                 || child.handle === launchingHandle
                 || terminalTabId(listing, child.handle) !== launchingTabId) {
-                await tombstone();
-                throw new OrcaError("split", `Orca narrator placement failed for ${name}: split receipt is unknown, malformed or handle-less; ${kept}`, env.raw);
+                return await indeterminate(malformed, env.raw);
             }
             const childHandle = child.handle;
             // The narrator writes nothing until the observer's single claim is visible, so neither write
             // can erase the other; after it the observer never writes the record again.
-            const claimDeadline = this.time.now() + 5000;
+            const claimDeadline = this.time.now() + CLAIM_WINDOW_MS;
             let claim;
             for (;;) {
                 const check = readBoard(path, cwd, runId);
@@ -1569,7 +1631,7 @@ export class OrcaDriver {
             if (!claim) {
                 // The receipt's handle may be closed; the reservation is tombstoned naming that pane so the
                 // next narrator can prove it gone (or close it) and split afresh.
-                await tombstone({ pane: childHandle, runtimeId: env.runtimeId });
+                await tombstoneReservation(path, cwd, runId, token, this.time, { pane: childHandle, runtimeId: env.runtimeId }).catch(() => undefined);
                 let pane;
                 try {
                     await this.closeRecordedPane(cwd, name, childHandle, env.runtimeId);
@@ -1584,6 +1646,67 @@ export class OrcaDriver {
             return watchSlot(cwd, name, childHandle);
         });
     }
+    /** OBS-1172: what an indeterminate split left behind, reconciled from the owner record and Orca's
+     *  terminal table — never from the receipt that did not arrive. The reservation's token reaches no
+     *  process but the split's own command, so a claim proves that split started a board; the owned
+     *  record (this driver, the watch title) is ours by that same token. The claimant must be live (pid
+     *  and arm presence), and it must name the terminal it runs in — a listed pane in the launching tab.
+     *  A claim that names none proves a board started, not WHICH pane hosts it: a sole neighbouring pane
+     *  (row titles are shell-controlled, never ownership keys) is not adopted, so the claim stays held.
+     *  No claim and no such pane: the split started nothing the table shows. Anything else is held. */
+    async settleIndeterminate(cwd, path, runId, token, launchingHandle, waitMs) {
+        const deadline = this.time.now() + waitMs;
+        let claim;
+        for (;;) {
+            let check;
+            try {
+                check = readBoard(path, cwd, runId);
+            }
+            catch (error) {
+                return { kind: "held", why: `the owner record is unreadable (${errorText(error)})` };
+            }
+            if (check?.record.token !== token || check.record.retired)
+                return { kind: "held", why: "the owner record changed underneath" };
+            if (boardState(check.record) === "claimed") {
+                claim = check;
+                break;
+            }
+            if (this.time.now() >= deadline)
+                break;
+            await this.time.sleep(20);
+        }
+        let listing;
+        try {
+            listing = await this.listAll(cwd);
+        }
+        catch (error) {
+            return { kind: "held", why: `the terminal table is unreadable (${errorText(error)})` };
+        }
+        const tab = terminalTabId(listing, launchingHandle);
+        if (!tab)
+            return { kind: "held", why: `the launching terminal ${launchingHandle} is not listed` };
+        const named = claim?.record.handle;
+        const panes = terminalRows(listing).map((row) => str(row.handle)).filter((h) => h !== undefined && h !== launchingHandle && terminalTabId(listing, h) === tab && (named === undefined || h === named));
+        if (!claim) {
+            return panes.length === 0 ? { kind: "absent" }
+                : { kind: "held", why: `no observer claimed the reservation and ${panes.length} pane(s) of unknown ownership share the launching tab` };
+        }
+        if (!observerLive(claim.record))
+            return { kind: "held", why: `the observer that claimed it (pid ${claim.record.pid}) is not live` };
+        if (named === undefined) {
+            return { kind: "held", why: `the observer that claimed it (pid ${claim.record.pid}) reports no terminal handle, so no listed pane is proven to host it` };
+        }
+        if (panes.length !== 1)
+            return { kind: "held", why: `its observer reports ${named}, which the launching tab does not list` };
+        const pane = panes[0];
+        try {
+            await casBoard("split", path, claim.raw, { ...claim.record, pane, runtimeId: listing.runtimeId }, this.time);
+        }
+        catch (error) {
+            return { kind: "held", why: `the bind was refused (${errorText(error)})` };
+        }
+        return { kind: "adopted", slot: watchSlot(cwd, claim.record.name, pane) };
+    }
     boardPath(cwd, runId) {
         return join(cwd, stateDirName(cwd), "supervision", `watch-board.${parseRunId(runId)}.json`);
     }
@@ -1621,13 +1744,28 @@ export class OrcaDriver {
     async retireAndClose(slot) {
         await this.serial(async () => {
             const retired = await this.retireBoard("close", slot);
-            if (typeof retired.pid === "number" && pidLive(retired.pid))
-                await stopWatchBoard(retired, this.time);
-            else
-                requestWatchBoardStop(retired);
+            await this.stopObserver(retired);
             await this.closeRecordedPane(slot.cwd, slot.name, slot.id, retired.runtimeId);
         });
     }
+    /** Stop a retired board's observer before its pane is closed. A live observer acknowledges on
+     *  injected time; a dead one never can, so it is only asked. OBS-1131: an acknowledgement timeout
+     *  is not proof of death — while the pid lives the owned pane stays protected — but a pid that died
+     *  during the wait is, and its pane is closed instead of leaked. */
+    async stopObserver(record) {
+        const pid = record.pid;
+        if (typeof pid !== "number" || !pidLive(pid)) {
+            requestWatchBoardStop(record);
+            return;
+        }
+        try {
+            await stopWatchBoard(record, this.time);
+        }
+        catch (error) {
+            if (pidLive(pid) || readWatchBoard(record.repo, record.runId)?.token !== record.token)
+                throw error;
+        }
+    }
     /** WB-1 seam: the daemon reports this board lost. "Lost" can be a stale beat or missing presence
      *  under a still-live owner pid, so it is not proof of a dead observer — retirement keeps close's
      *  acknowledgement discipline (Leg-2 T9 P1). */

package/dist/eval/canary.d.ts

@@ -1,4 +1,5 @@
 import type { WorkerAdapter } from "../adapters/types.js";
+import type { Effort } from "../graph/schema.js";
 import { type Fixture } from "./fixtures.js";
 export declare const CANARY_FIXTURE_ID = "canary";
 export interface CanaryJudgeResult {
@@ -35,7 +36,7 @@ export declare function ensureCanary(fixtures: Fixture[], root: string): Fixture
  * is evaluated against the resulting diff. A correct judge returns pass=false; any pass=true
  * verdict is flagged as a judge-integrity breach.
  */
-export declare function runCanaryJudge(fixture: Fixture, judgeAdapter: WorkerAdapter, model: string): Promise<CanaryJudgeResult>;
+export declare function runCanaryJudge(fixture: Fixture, judgeAdapter: WorkerAdapter, model: string, effort?: Effort): Promise<CanaryJudgeResult>;
 /**
  * Aggregate per-channel qualification totals from fixture-channel results.
  * Results marked as canary (by the supplied predicate, defaulting to isCanaryResult) are excluded

package/dist/eval/canary.js

@@ -53,7 +53,7 @@ async function applyKnownBadChange(repo) {
  * is evaluated against the resulting diff. A correct judge returns pass=false; any pass=true
  * verdict is flagged as a judge-integrity breach.
  */
-export async function runCanaryJudge(fixture, judgeAdapter, model) {
+export async function runCanaryJudge(fixture, judgeAdapter, model, effort) {
     if (!isCanaryFixture(fixture)) {
         throw new Error(`fixture ${fixture.id} is not the canary fixture`);
     }
@@ -62,7 +62,7 @@ export async function runCanaryJudge(fixture, judgeAdapter, model) {
     const initialCommit = (await shGitOk("git rev-parse HEAD", seeded.repo)).trim();
     try {
         await applyKnownBadChange(seeded.repo);
-        const gateResult = await acceptanceGate(task, seeded.repo, initialCommit, { adapter: judgeAdapter, model });
+        const gateResult = await acceptanceGate(task, seeded.repo, initialCommit, { adapter: judgeAdapter, model, effort });
         const expectedPass = false;
         const judgePass = gateResult.pass;
         const breach = judgePass === true && expectedPass === false;

package/dist/eval/dispatch.js

@@ -157,6 +157,7 @@ async function dispatchChannel(task, channel, adapter, promptFile, nonce, fixtur
         model: channel.model,
         channel: channel.channel,
         tier: channel.tier,
+        ...(channel.effort ? { effort: channel.effort } : {}), // OBS-1182: measured at the effort it would run at
     };
     const invocation = adapter.invoke(task, seeded.repo, assignment, { promptFile });
     const run = await sh(invocation.command, seeded.repo, cfg.taskTimeoutMinutes * 60_000);

package/dist/gates/acceptance.d.ts

@@ -1,5 +1,5 @@
 import { type WorkerAdapter } from "../adapters/types.js";
-import { type AcceptanceItem, type Task } from "../graph/schema.js";
+import { type Effort, type AcceptanceItem, type Task } from "../graph/schema.js";
 import { type LlmVia } from "./llm.js";
 import type { GateResult } from "./types.js";
 export interface EvidenceCitation {
@@ -62,4 +62,5 @@ export interface AcceptanceGateOpts {
 export declare function acceptanceGate(task: Task, worktree: string, baseRef: string, judge: {
     adapter: WorkerAdapter;
     model: string;
+    effort?: Effort;
 }, via?: LlmVia, opts?: AcceptanceGateOpts): Promise<GateResult>;

package/dist/gates/acceptance.js

@@ -342,7 +342,9 @@ function citesChangedLocation(evidence, changed, diff) {
         return evidence.trim().length > 0 && diff.includes(evidence);
     return changed.get(evidence.path)?.has(evidence.line) ?? false;
 }
-export async function acceptanceGate(task, worktree, baseRef, judge, via, opts = {}) {
+export async function acceptanceGate(task, worktree, baseRef, 
+// OBS-1182: the judge seat's OWN effort (absent = CLI default) — never the worker's.
+judge, via, opts = {}) {
     // 1. deterministic oracles — exit code decides, fail-closed, zero LLM calls (spec §2, T2).
     //    A failure returns here, before any runLlm() call: a judge can never override it.
     const passedDet = [];
@@ -439,7 +441,10 @@ Each criteria[].criterion MUST be the stable id from the rubric (c1, c2, ...) ex
 Each criteria[].evidence MUST be a structured citation {"path", "line"} whose "path" and "line" appear in the "Citable evidence lines" list above (a new-file line number inside a changed hunk); a citation outside every changed hunk or to an untouched file voids the whole verdict.
 The top-level comments array is optional. Use it only for actionable line-anchored feedback.
 `;
-    const raw = await runLlm(judge.adapter, judge.model, prompt, worktree, via, JUDGE_TIMEOUT_MS);
+    // OBS-1182: an unset seat passes no effort argument at all — the CLI default, and the call shape callers pin.
+    const raw = await (judge.effort
+        ? runLlm(judge.adapter, judge.model, prompt, worktree, via, JUDGE_TIMEOUT_MS, judge.effort)
+        : runLlm(judge.adapter, judge.model, prompt, worktree, via, JUDGE_TIMEOUT_MS));
     const extracted = extractVerdictJson(raw, nonce);
     if (!extracted) {
         const cause = classifyVerdictCause(raw, nonce, "pass");

package/dist/gates/baseline.d.ts

@@ -47,7 +47,7 @@ export declare function beginGateEvidence(cwd: string, gate: string, command: st
             subjectCommit: string | null;
         };
         termination: {
-            kind: "unknown" | "signal" | "not-started" | "exit" | "timeout";
+            kind: "unknown" | "timeout" | "signal" | "not-started" | "exit";
             exitCode: number | null;
             signal: string | null;
             timedOut: boolean | null;
@@ -127,9 +127,19 @@ export interface BaselineFileDuration {
     file: string;
     durationMs: number;
 }
+/**
+ * OBS-1123: WHICH capture a forgiveness rests on — the commit it measured and when it was published.
+ * Stamped by the daemon beside the measurement; absent on every baseline.json written before it, which
+ * readers must render as unknown provenance and never date from any other clock.
+ */
+export interface BaselineProvenance {
+    baseRef: string;
+    capturedAt: string;
+}
 export interface Baseline {
     /** No command ran because the dependency inventory could not establish isolation. */
     refusal?: string;
+    provenance?: BaselineProvenance;
     /** Observational capture receipts stay outside the forgiveness-bearing command entries. */
     evidenceReceipts?: Record<string, GateEvidenceReceipt>;
     commands: Record<string, BaselineCommand>;
@@ -156,6 +166,7 @@ export declare function fingerprint(output: string): string[];
 export declare function freshFailures(entry: BaselineCommand | undefined, raw: string): {
     failing: string[];
     unreadable: boolean;
+    forgiven: string[];
 };
 export type PackageManager = "npm" | "pnpm" | "yarn" | "bun";
 /**

package/dist/gates/baseline.js

@@ -428,7 +428,9 @@ export function freshFailures(entry, raw) {
     // OBS-42: diagnostic headings enrich fingerprints but cannot invalidate legacy baselines.
     const current = fingerprint(raw);
     const fresh = current.filter((f) => !known.has(f) && (!FAIL_ANCHOR_RE.test(f) || f.startsWith("FAIL ")));
-    return { failing: fresh.filter((f) => f !== UNRECOGNIZED_FAILURE), unreadable: current.includes(UNRECOGNIZED_FAILURE) };
+    // OBS-1123: the baseline-recorded half, named so a reader never has to infer it from the fresh half.
+    return { failing: fresh.filter((f) => f !== UNRECOGNIZED_FAILURE), unreadable: current.includes(UNRECOGNIZED_FAILURE),
+        forgiven: current.filter((f) => known.has(f)) };
 }
 /**
  * Operator directive 2026-08-12 (D-OBS-10): tickmarkr is package-manager agnostic.
@@ -880,7 +882,10 @@ export async function compareToBaseline(cwd, commands, baseline, enabled, opts =
         // below rather than reading as a verified green. Raise the ceiling by teaching isFailureShaped
         // that runner's position rule (leading verdict + identifier, or identifier + separator + trailing
         // verdict); loosening back to vocabulary re-opens OBS-278.
-        const { failing, unreadable } = freshFailures(entry, raw);
+        const { failing, unreadable, forgiven } = freshFailures(entry, raw);
+        // OBS-1123: which baseline-recorded fingerprints this verdict carried, and the capture that
+        // recorded them. Observational only — nothing below reads it to decide a verdict.
+        const provenance = baseline.provenance ? { baselineProvenance: baseline.provenance } : {};
         // T9: classify the FRESH diff before charging it. The complete runner output can legitimately
         // contain a baseline-recorded assertion beside a newly introduced infrastructure death; letting
         // that known assertion outvote the fresh birpc line turns machine failure into a worker defect.
@@ -957,7 +962,9 @@ export async function compareToBaseline(cwd, commands, baseline, enabled, opts =
         }
         if (failing.length) {
             const headlined = headlineDetails(raw, failing);
-            const meta = { ...headlined.meta, ...(classification ? { classification } : {}) };
+            // A fresh red beside baseline-recorded ones names both halves, so no reader shows the new one as forgiven.
+            const meta = { ...headlined.meta, ...(classification ? { classification } : {}),
+                ...(forgiven.length ? { freshFingerprints: failing, forgivenFingerprints: forgiven, ...provenance } : {}) };
             record({ gate: name, pass: false, details: headlined.details, ...(Object.keys(meta).length ? { meta } : {}) });
             continue;
         }
@@ -981,7 +988,7 @@ export async function compareToBaseline(cwd, commands, baseline, enabled, opts =
             gate: name,
             pass: true,
             details: `exit ${r.code} but only pre-existing failures (forgiven)${unreadable ? " — no failure shape recognized in this output, so a new failure from this runner is invisible to the baseline gate" : ""}`,
-            ...(classification ? { meta: { classification } } : {}),
+            meta: { ...(classification ? { classification } : {}), forgivenFingerprints: forgiven, ...provenance },
         });
     }
     return results;

package/dist/gates/cache.d.ts

@@ -36,9 +36,11 @@ export interface VerificationIdentity {
     gate?: string;
     /** which verifier produced it: a battery gate row or an integration-tip row (own report, own forgiveness rule) */
     scope?: VerificationScope;
-    /** Checkout location is diagnostic metadata; equal trees share verdicts across worktrees. */
+    /** Checkout location is diagnostic metadata; build outputs additionally require an incarnation. */
     worktree?: string;
     tree: string;
+    /** Build success also promises local outputs, which die with the checkout. */
+    checkoutIncarnation?: string;
     command: string;
     baseline: string;
     environment: string;

package/dist/gates/cache.js

@@ -3,7 +3,7 @@ import { execSync } from "node:child_process";
 import { existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
 import { dirname, join, relative, resolve } from "node:path";
 import { tmpdir } from "node:os";
-import { describeCapacity, inventoryDependencyLinks, resolvedCapacity, shGit, verificationProtocol } from "../run/git.js";
+import { checkoutIncarnation, describeCapacity, inventoryDependencyLinks, resolvedCapacity, shGit, verificationProtocol } from "../run/git.js";
 import { shq } from "../adapters/types.js";
 export const DEFAULT_VERDICT_CACHE_BOUND = 128;
 let testCacheBound;
@@ -114,6 +114,9 @@ export async function computeVerificationIdentity(params) {
     const tree = params.tree ?? (await getWorktreeTree(params.worktree));
     if (!tree)
         return undefined;
+    const incarnation = params.gate === "build" ? checkoutIncarnation(params.worktree) : undefined;
+    if (params.gate === "build" && !incarnation)
+        return undefined;
     const baseline = baselineIdentity(params.baseline);
     const env = environmentFingerprint({
         worktree: params.worktree,
@@ -129,6 +132,7 @@ export async function computeVerificationIdentity(params) {
         scope: params.scope ?? "battery",
         worktree: realpathSync(params.worktree),
         tree,
+        ...(incarnation ? { checkoutIncarnation: incarnation } : {}),
         command: params.command,
         baseline,
         environment: env.fingerprint,
@@ -138,8 +142,10 @@ export async function computeVerificationIdentity(params) {
 export function verificationIdentityKey(id) {
     const cmdHash = createHash("sha256").update(id.command).digest("hex").slice(0, 16);
     const gate = id.gate ?? "gate";
-    // Checkout location is diagnostic only. Scope separates each verifier's evidence policy.
-    const workingTree = createHash("sha256").update(id.tree).digest("hex");
+    // Lint/test remain content-addressed. Builds also promise outputs in this physical checkout.
+    // Scope continues to separate each verifier's evidence policy.
+    const workingTree = createHash("sha256").update(id.tree)
+        .update(id.gate === "build" ? `\0checkout:${id.checkoutIncarnation ?? "unbound"}` : "").digest("hex");
     return `${id.scope ?? "battery"}-${gate}-${workingTree}-${cmdHash}-${id.baseline}-${id.environment}`;
 }
 export function formatReusedDetails(originalDetails, id) {
@@ -179,6 +185,7 @@ export function reusedIdentity(id) {
         gate: id.gate ?? "gate",
         scope: id.scope ?? "battery",
         tree: id.tree,
+        ...(id.checkoutIncarnation ? { checkoutIncarnation: id.checkoutIncarnation } : {}),
         ...(id.worktree ? { worktree: id.worktree } : {}),
         command: id.command,
         baseline: id.baseline,